PHP: 除去フィルタ

除去フィルタ

**除去フィルタの一覧**
ID	名前	フラグ	説明
`FILTER_SANITIZE_EMAIL`	"email"		英字、数字および !#$%&'*+-=?^_`{\|}~@.[] 以外のすべての文字を取り除きます。
`FILTER_SANITIZE_ENCODED`	"encoded"	`FILTER_FLAG_STRIP_LOW`, `FILTER_FLAG_STRIP_HIGH`, `FILTER_FLAG_STRIP_BACKTICK`, `FILTER_FLAG_ENCODE_LOW`, `FILTER_FLAG_ENCODE_HIGH`	文字列を URL エンコードします。オプションで、特殊文字を取り除いたりエンコードしたりします。
`FILTER_SANITIZE_MAGIC_QUOTES`	"magic_quotes"		addslashes() を適用します。 (PHP 7.3.0 以降は非推奨になり、 PHP 8.0.0 以降削除されています。代わりに `FILTER_SANITIZE_ADD_SLASHES` を使ってください)
`FILTER_SANITIZE_ADD_SLASHES`	"add_slashes"		addslashes() を適用します。 (PHP 7.3.0 以降で利用可能です)
`FILTER_SANITIZE_NUMBER_FLOAT`	"number_float"	`FILTER_FLAG_ALLOW_FRACTION`, `FILTER_FLAG_ALLOW_THOUSAND`, `FILTER_FLAG_ALLOW_SCIENTIFIC`	数字、`+-` およびオプションで `.,eE` 以外のすべての文字を取り除きます。
`FILTER_SANITIZE_NUMBER_INT`	"number_int"		数字、プラス記号、マイナス記号以外のすべての文字を取り除きます。
`FILTER_SANITIZE_SPECIAL_CHARS`	"special_chars"	`FILTER_FLAG_STRIP_LOW`, `FILTER_FLAG_STRIP_HIGH`, `FILTER_FLAG_STRIP_BACKTICK`, `FILTER_FLAG_ENCODE_HIGH`	`'"<>&` および ASCII 値が 32 未満の文字を HTML エンコードします。オプションで、その他の特殊文字を取り除いたりエンコードしたりします。
`FILTER_SANITIZE_FULL_SPECIAL_CHARS`	"full_special_chars"	`FILTER_FLAG_NO_ENCODE_QUOTES`	htmlspecialchars() に `ENT_QUOTES` を指定してコールするのと同じです。クォートのエンコードを無効にするには `FILTER_FLAG_NO_ENCODE_QUOTES` を設定します。 htmlspecialchars() と同様、このフィルタは default_charset に対応しています。現在の文字セットで無効な文字となるバイトシーケンスが検出されると文字列全体を拒否し、結果は長さ 0 の文字列となります。このフィルタをデフォルトのフィルタとして使う場合は、以下の警告を参考にしてデフォルトのフラグを 0 に設定しましょう。
`FILTER_SANITIZE_STRING`	"string"	`FILTER_FLAG_NO_ENCODE_QUOTES`, `FILTER_FLAG_STRIP_LOW`, `FILTER_FLAG_STRIP_HIGH`, `FILTER_FLAG_STRIP_BACKTICK`, `FILTER_FLAG_ENCODE_LOW`, `FILTER_FLAG_ENCODE_HIGH`, `FILTER_FLAG_ENCODE_AMP`	タグと、エンコードされたシングルクォート、ダブルクォートを取り除きます。オプションで、特殊文字を取り除いたりエンコードしたりします。クォートをエンコードする動作は、 `FILTER_FLAG_NO_ENCODE_QUOTES` を設定することで無効に出来ます。 (PHP 8.1.0 以降は非推奨になりました。代わりに htmlspecialchars() を使って下さい)
`FILTER_SANITIZE_STRIPPED`	"stripped"		"string" フィルタのエイリアス。 (PHP 8.1.0 以降は非推奨になりました。代わりに htmlspecialchars() を使って下さい)
`FILTER_SANITIZE_URL`	"url"		英字、数字および $-_.+!*'(),{}\|\\^~[]`<>#%";/?:@&= 以外のすべての文字を取り除きます。
`FILTER_UNSAFE_RAW`	"unsafe_raw"	`FILTER_FLAG_STRIP_LOW`, `FILTER_FLAG_STRIP_HIGH`, `FILTER_FLAG_STRIP_BACKTICK`, `FILTER_FLAG_ENCODE_LOW`, `FILTER_FLAG_ENCODE_HIGH`, `FILTER_FLAG_ENCODE_AMP`	何もせず、オプションで特殊文字を取り除いたりエンコードしたりします。 `FILTER_DEFAULT` は、このフィルタのエイリアスです。

警告

これらのフィルタのいずれかを ini ファイルやウェブサーバーの設定でデフォルトフィルタとして使用すると、デフォルトのフラグは FILTER_FLAG_NO_ENCODE_QUOTES となります。デフォルトでクォートをエンコードさせるには、明示的に filter.default_flags を 0 としなければなりません。

例1 デフォルトのフィルタを htmlspecialchars と同様の挙動にする設定

filter.default = full_special_chars
filter.default_flags = 0

変更履歴

バージョン	説明
8.1.0	`FILTER_SANITIZE_STRING` と `FILTER_SANITIZE_STRIPPED` は推奨されなくなりました。
8.0.0	`FILTER_SANITIZE_MAGIC_QUOTES` が削除されました。
7.3.0	`FILTER_SANITIZE_MAGIC_QUOTES` の代替として `FILTER_SANITIZE_ADD_SLASHES` が追加されました。
7.3.0	`FILTER_SANITIZE_MAGIC_QUOTES` は推奨されなくなりました。

add a note

User Contributed Notes 16 notes

down

googlybash24 at aol dot com ¶

12 years ago


Remember to trim() the $_POST before your filters are applied:

<?php

// We trim the $_POST data before any spaces get encoded to "%20"

// Trim array values using this function "trim_value"
function trim_value(&$value)
{
    $value = trim($value);    // this removes whitespace and related characters from the beginning and end of the string
}
array_filter($_POST, 'trim_value');    // the data in $_POST is trimmed

$postfilter =    // set up the filters to be used with the trimmed post array
    array(
            'user_tasks'                        =>    array('filter' => FILTER_SANITIZE_STRING, 'flags' => !FILTER_FLAG_STRIP_LOW),    // removes tags. formatting code is encoded -- add nl2br() when displaying
            'username'                            =>    array('filter' => FILTER_SANITIZE_ENCODED, 'flags' => FILTER_FLAG_STRIP_LOW),    // we are using this in the url
            'mod_title'                            =>    array('filter' => FILTER_SANITIZE_ENCODED, 'flags' => FILTER_FLAG_STRIP_LOW),    // we are using this in the url
        );

$revised_post_array = filter_var_array($_POST, $postfilter);    // must be referenced via a variable which is now an array that takes the place of $_POST[]
echo (nl2br($revised_post_array['user_tasks']));    //-- use nl2br() upon output like so, for the ['user_tasks'] array value so that the newlines are formatted, since this is our HTML <textarea> field and we want to maintain newlines
?>

down

ipse at sergiosantos dot me ¶

4 years ago


Although it's specifically mentioned in the above documentation, because many seem to find this unintuitive it's worth pointing out that FILTER_SANITIZE_NUMBER_FLOAT will remove the decimal character unless you specify FILTER_FLAG_ALLOW_FRACTION:

<?php
$number_string = '12.34';

echo filter_var( $number_string, FILTER_SANITIZE_NUMBER_FLOAT ); // 1234

echo filter_var( $number_string, FILTER_SANITIZE_NUMBER_FLOAT, FILTER_FLAG_ALLOW_FRACTION ); // 12.34
?>

down

Anonymous ¶

9 years ago


FILTER_SANITIZE_STRING doesn't behavior the same as strip_tags function.    strip_tags allows less than symbol inferred from context, FILTER_SANITIZE_STRING strips regardless.
<?php
$smaller = "not a tag < 5";
echo strip_tags($smaller);    // -> not a tag < 5
echo filter_var ( $smaller, FILTER_SANITIZE_STRING); // -> not a tag
?>

down

Willscrlt ¶

8 years ago


To include multiple flags, simply separate the flags with vertical pipe symbols.

For example, if you want to use filter_var() to sanitize $string with FILTER_SANITIZE_STRING and pass in FILTER_FLAG_STRIP_HIGH and FILTER_FLAG_STRIP_LOW, just call it like this:

$string = filter_var($string, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_HIGH | FILTER_FLAG_STRIP_LOW);

The same goes for passing a flags field in an options array in the case of using callbacks.

$var = filter_var($string, FILTER_SANITIZE_SPECIAL_CHARS,
array('flags' => FILTER_FLAG_STRIP_LOW | FILTER_FLAG_ENCODE_HIGH));

Thanks to the Brain Goo blog at popmartian.com/tipsntricks/for this info.

down

AntonioPrimera ¶

8 years ago


Please be aware that when using filter_var() with FILTER_SANITIZE_NUMBER_FLOAT and FILTER_SANITIZE_NUMBER_INT the result will be a string, even if the input value is actually a float or an int.

Use FILTER_VALIDATE_FLOAT and FILTER_VALIDATE_INT, which will convert the result to the expected type.

down

marcus at synchromedia dot co dot uk ¶

15 years ago


It's not entirely clear what the LOW and HIGH ranges are. LOW is characters below 32, HIGH is those above 127, i.e. outside the ASCII range.

<?php
$a = "\tcafé\n";
//This will remove the tab and the line break
echo filter_var($a, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW);
//This will remove the é.
echo filter_var($a, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_HIGH);
?>

down

galvao at galvao dot eti dot br ¶

11 years ago


Just to clarify, since this may be unknown for a lot of people:



ASCII characters above 127 are known as "Extended" and they represent characters such as greek letters and accented letters in latin alphabets, used in languages such as pt_BR.



A good ASCII quick reference (aside from the already mentioned Wikipedia article) can be found at: http://www.asciicodes.com/

down

david dot drakulovski at gmail dot com ¶

10 years ago


Here is a simpler and a better presented ASCII list for the <32 or 127> filters 
(if wikipedia confused the hell out of you):

http://www.danshort.com/ASCIImap/

down

finkenb2 at msu dot edu ¶

1 year ago


With the deprecation of FILTER_SANITIZE_STRING, the "use htmlspecialchars instead" is an incomplete comment.  The functionality of FILTER_SANITIZE_STRING was a combination of htmlspcialchars and (approximately) strip_tags.  For true compatibility a polyfil may be needed:

<?php
function filter_string_polyfill(string $string): string
{
    $str = preg_replace('/\x00|<[^>]*>?/', '', $string);
    return str_replace(["'", '"'], ['&#39;', '&#34;'], $str);
}

$string = "Some \"' <bizzare> string & to Sanitize < !$@%";
echo filter_var($string,FILTER_SANITIZE_STRING).PHP_EOL;
//Some &#34;&#39;  string & to Sanitize 

echo htmlspecialchars($string).PHP_EOL;
//Some &quot;&#039; &lt;bizzare&gt; string &amp; to Sanitize &lt; !$@%

echo strip_tags($string).PHP_EOL;
//Some "'  string & to Sanitize < !$@%

echo htmlspecialchars(strip_tags($string,ENT_QUOTES)).PHP_EOL;
//Some &quot;&#039;  string &amp; to Sanitize &lt; !$@%

echo filter_string_polyfill($string).PHP_EOL;
//Some &#34;&#39;  string & to Sanitize

down

-2

darren at daz-web dot com ¶

6 years ago


For those looking for a simple way around filtering POST forms that have textarea elements in them. If you also need tab for example you can extend quite easily.

<?php 
//create an array of all relevant textareas
$textareas = array("ta1");

foreach($_POST as $k => $v)
    {
        $v = trim($v);//so we are sure it is whitespace free at both ends
    
        //preserve newline for textarea answers
        if(in_array($k,$textareas))$v=str_replace("\n","[NEWLINE]",$v); 
    
        //sanitise string
        $v = filter_var($v, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH | FILTER_FLAG_STRIP_BACKTICK);
    
        //now replace the placeholder with the original newline
        $_POST[$k] = str_replace("[NEWLINE]","\n",$v);
    }

//simple form for testing submital

?><!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>Filter test</title>
</head>

<body>
    
<form action="" method="post">
    <p>
        <textarea name="ta1" cols="30" rows="10"><?php echo $_POST['ta1']; ?></textarea>
    </p>
    <p>
        <input type="text" name="txt1" size="30" value="<?php echo $_POST['txt1']; ?>" />
    </p>
    <p>
        <input type="submit" />    
    </p>
    </form>

</body>
    
</html>

down

-7

adellemfrank at hotmail dot com ¶

12 years ago


A good list of which ASCII characters are < 32 and > 127 can be found at: http://en.wikipedia.org/wiki/ASCII#ASCII_printable_characters

down

-5

Rodrigo Guariento ¶

4 years ago


To get ONLY numbers from a string use this code:
    echo preg_replace('/[^0-9]/', '', '123456-789');

down

-8

anonymous ¶

4 years ago


In the "FILTER_SANITIZE_URL" section where it says, "Remove all characters except letters, digits and $-_.+!*'(),{}|\\^~[]`<>#%";/?:@&=." is there a reason why there is a double backslash (\\)? Shouldn't there only be one backslash if it's saying that backslashes are allowed?

down

-7

Anonymous ¶

4 years ago


<?php
 /*
     filter all ascii and save juste 0-9 a-Z and @ . _
*/

echo alphanum('abcdefghABCDEFGH0123456789/!:;@._');
// return abcdefghABCDEFGH0123456789@._

function alphanum( $string , $x=''){
        $h=strlen($string);
        for($a=0; $a<$h; $a++) {
            $i = ord($string[$a]);
            if( 
                ($i==46) || // .
                ($i==64) || // @
                ($i==95) || // _
                ($i > 47 && $i < 58) || //0123456789 
                ($i > 64 && $i < 91) || //ABCDEFGH..Z
                ($i > 96 && $i < 123)   //abcdefgh..z
             ) { $x .= $string[$a]; }    
        }
        return $x;
    }

?>

down

-24

Anonymous ¶

11 years ago


Support for FILTER_SANITIZE_FULL_SPECIAL_CHARS was added from version 5.3.3

down

-39

Dmitry Snytkine ¶

13 years ago


Beware that FILTER_FLAG_STRIP_LOW strips NEWLINE and TAG and CARRIAGE RETURN chars. If you have a form that accepts user input in plaintext format, all the submitted text will lose all the line breaks, making it appear all on one line. This basically renders this filter useless for parsing user-submitted text, even in plain text.

add a note